CVE-2020-14206

The DiveBook WordPress plugin (version 1.1.4) is affected by an unauthenticated Cross‑Site Scripting (XSS) vulnerability in the filter function, exploitable via an arbitrary parameter. Affects: DiveBook plugin for WordPress up to 1.1.4 (no patch found per Patchstack notes); impact: potential scri...

CVE-2020-14207

CVE-2020-14207 concerns the WordPress DiveBook plugin, version 1.1.4. The issue is a SQL injection in divelog.php triggered by the GET/POST parameter filter_diver , allowing unauthenticated attackers to retrieve data from the database. The connected documents do not provide a patched version or r...

CVE-2020-14205

affected software: WordPress DiveBook plugin 1.1.4; vulnerability: improper access control in the Log Dive form due to missing authorization checks; impact: could allow an attacker to manipulate the integrity of dive logs. root cause: failure to perform authorization checks on log dive submission...